Deck API: CardApiController reorder() ignores request body stackId due to route parameter conflict

[ktrbrg]

Cards cannot be moved between stacks via the Deck REST API. The reorder endpoint always keeps the card in its current stack.

How to reproduce:

1. Create a card in stack 36:

curl -s -X POST \
  -H 'Content-Type: application/json' \
  -d '{"title":"Test card","stackId":36}' \
  'https://host/apps/deck/api/v1.0/boards/1/stacks/36/cards?format=json'

1. Try to move it to stack 37 via reorder:

curl -s -X PUT \
  -H 'Content-Type: application/json' \
  -d '{"stackId":37,"order":0}' \
  'https://host/apps/deck/api/v1.0/boards/1/stacks/36/cards/{cardId}/reorder?format=json'

1. Card remains in stack 36 with stackId=36.

Expected behavior:
Card should move to stack 37 (stackId=37).

Root cause:
The reorder() method in lib/Controller/CardApiController.php receives $stackId as a function parameter:

public function reorder($stackId, $order) {
    $card = $this->cardService->reorder(
        (int)$this->request->getParam('cardId'),
        (int)$stackId,
        (int)$order
    );
    return new DataResponse($card, HTTP::STATUS_OK);
}

The route definition places {stackId} in the URL path:

['name' => 'card_api#reorder', 'url' => '/api/v{apiVersion}/boards/{boardId}/stacks/{stackId}/cards/{cardId}/reorder', 'verb' => 'PUT'],

Nextcloud's ApiController maps route parameters to method parameters with matching names. Since the URL contains {stackId}, the route parameter value (the source stack, e.g. 36) takes precedence over any stackId in the request body or query string. The card is thus "reordered" to the same stack it was already in.

The same issue affects update() which uses $this->request->getParam('stackId') — this also returns the route parameter value.

Workaround:
Read stackId from the raw request body instead:

public function reorder($stackId, $order) {
    $input = json_decode(file_get_contents('php://input'), true);
    $targetStackId = isset($input['stackId']) ? (int)$input['stackId'] : (int)$stackId;
    $card = $this->cardService->reorder(
        (int)$this->request->getParam('cardId'),
        $targetStackId,
        (int)$order
    );
    return new DataResponse($card, HTTP::STATUS_OK);
}

Server details:

• Nextcloud version: 32.x (AIO)
• Deck version: 1.16.4
• Deck API versions: 1.0, 1.1
• OS: Ubuntu 24.04 (Docker AIO)
• Web server: Caddy (reverse proxy) + Apache (internal)
• Database: PostgreSQL 17
• PHP version: 8.3